StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Server client IoT and OT security

Practice question 302 of 498 · medium

An AD domain runs below Windows Server 2016 DFL. Which limitation must the LAPS architect account for?

Choose the single best answer.

  1. A.Local password management cannot work in any form
  2. B.AD password encryption cannot be enabled until the DFL requirement is met
  3. C.All domain controllers automatically support DSRM password management
  4. D.Entra ID must store every DSRM password
Show the answer and explanation

✓ Correct answer

  • AD password encryption cannot be enabled until the DFL requirement is met

AD LAPS encryption requires DFL 2016 or later; clear-text attributes protected by ACLs remain possible below that level. Entra ID does not support DSRM backup. DSRM management also requires suitable DC operating-system support.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.